Google’s Agent Development Kit (ADK) for Python has been found vulnerable to a novel attack vector, where one AI agent can be used to compromise another. This “agent-to-agent” exploitation allows malicious text to be injected into trusted automation workflows, potentially disrupting the software supply chain.
Researchers from Pillar Security discovered the flaws in Google’s open-source ADK, which is downloaded over 90 million times and widely used by developers working with Gemini, Google’s large language model (LLM). The vulnerabilities allowed a low-privileged AI agent to trigger commands that could be executed by a high-privileged one, demonstrating a new class of attack not seen in real production systems until now.
The attack relies on prompt injections embedded in GitHub pull requests to exploit the trust boundary between two AI agents with different privilege levels. In their proof-of-concept (PoC) exploit, the researchers showed that a public-facing AI agent reviewing pull requests could be manipulated into triggering a maintainer-only AI agent capable of performing privileged actions. This created a pathway to approve or execute malicious code in continuous integration (CI)/continuous delivery (CD) workflows that affect the development process and thus the software supply chain.
The discovery is significant because it highlights the emerging threat of autonomous LLM attacks and introduces a new privilege-escalation attack surface. “Enterprises are starting to put multiple AI agents into software delivery with different tools, permissions, and levels of authority,” says Ryan McCurdy, vice president of marketing at database governance firm Liquibase. “This research shows why governing each agent independently isn’t enough. Organizations also have to understand what one agent can cause another agent to do.”
The flaws were characterized as a prompt injection issue, but the real issue it created for how organizations are using AI agents is delegation. “A low-privileged agent shouldn’t be able to use a higher-privileged agent to get around controls it couldn’t bypass on its own,” McCurdy notes.
Google has since fixed the issues, which were reported in early June and remediated on July 9 and July 21, respectively. The discovery demonstrates how interactions between AI agents are emerging as a new security consideration for enterprises when developing AI agent behavior.
The bigger takeaway from the discovery of the flaws is that AI agents are changing some of the assumptions security teams have relied on. As organizations continue to develop and deploy AI-powered automation workflows, they must understand what one agent can cause another to do. This requires governing each agent independently and ensuring that low-privileged agents cannot use higher-privileged agents to bypass controls.
For developers using Google’s ADK for Python, this means being mindful of the potential for malicious text to be injected into trusted automation workflows. It also highlights the need for organizations to regularly review and update their security protocols as new threats emerge. By staying ahead of these emerging threats, organizations can ensure that their AI-powered systems remain secure and reliable.
Source: Dark Reading — 2026-08-05